● Community
zxkane
⚡ Instant
aws-skills
by zxkane · zxkane/aws-skills
Claude agent skills for AWS — shell-first workflows covering common services, with sensible defaults and least-privilege IAM.
aws-skills wraps common AWS CLI workflows as agent skills: EC2 fleet ops, S3 policy checks, IAM audits, CloudFormation/CDK scaffolding, and cost queries. Shell-first so you always see the commands being run. Pairs well with TerraShark for IaC.
Why use it
Key features
- Shell-first — commands visible before execution
- Common services: EC2, S3, IAM, Lambda, CloudFormation, Cost Explorer
- Least-privilege IAM defaults
- Region and profile aware
- Works with Claude Code and Codex
Live Demo
What it looks like in practice
Use Cases
Real-world ways to use aws-skills
When to use: You need to patch or restart a group of instances matching a tag, without writing the whole script yourself.
Flow
-
Dry-run the query
Use aws-skill. List EC2 instances tagged Env=staging, App=api. Just describe, don't mutate.✓ Copied
→ Table of instance IDs with state
-
Plan the action
Now propose the command to restart all running ones. Show me the exact aws cli call before running it.✓ Copied
→ Command printed; no execution yet
-
Execute with guardrails
Execute in batches of 3 with 30s between batches. Abort if any fails.✓ Copied
→ Batched output with success/failure per batch
Outcome: A controlled fleet operation with no unpleasant surprises.
Pitfalls
- Wrong profile/region destroys prod — Always echo the resolved profile + region as the first line of any action
When to use: Before a compliance review, or after a misconfig alert.
Flow
-
List buckets
List all S3 buckets in our account with their public access block settings and any bucket policies that allow *.✓ Copied
→ Table with per-bucket status
-
Triage
Flag buckets that have public access and don't match our known public-bucket allowlist (list: [...]). Propose remediation for each.✓ Copied
→ Remediation plan per flagged bucket
Outcome: A prioritized remediation list for S3 public exposure.
Pitfalls
- OAI / OAC for CloudFront looks public at the bucket level — Check CloudFront origin config before flagging
When to use: A service account works with AdministratorAccess and you want to scope it down.
Flow
-
Collect usage
Pull the Access Analyzer / CloudTrail-derived actions used by this role over last 30 days.✓ Copied
→ Actions table
-
Generate scoped policy
Write the minimal policy matching those actions. No wildcard Resource unless necessary; comment where wildcards are justified.✓ Copied
→ Policy JSON with comments
Outcome: A least-privilege policy with documented rationale.
Pitfalls
- 30 days isn't long enough to capture all paths — Verify against known monthly or quarterly jobs before flipping the policy
When to use: Finance asks 'why did S3 spend spike in April?' — you want an answer before the meeting.
Flow
-
Query
Use Cost Explorer to compare S3 spend April vs March by usage type.✓ Copied
→ Diff table by usage type
-
Explain
Which usage type grew most, and which bucket is most likely responsible?✓ Copied
→ Hypothesis with specific bucket candidates
Outcome: A specific attribution you can follow up on.
Combinations
Pair with other MCPs for X10 leverage
AWS-skill for one-off ops, TerraShark for codified infra
Investigate with aws-skill, then codify the fix as Terraform with terrashark.✓ Copied
Security reviews on IAM and S3 configs
After IAM scoping, run OWASP review on the resulting policy.✓ Copied
Cost & Limits
What this costs to run
- API quota
- AWS API limits vary per service; usually non-issue for interactive use
- Tokens per call
- 5-15k for planning; execution is free of Claude tokens
- Monetary
- Free skill; AWS usage billed as normal
- Tip
- Cost Explorer API has per-request pricing. Cache results when iterating.
Security
Permissions, secrets, blast radius
Credential storage: Standard AWS CLI credentials (shared config, SSO). Skill reads active profile.
Data egress: All AWS API calls. Command outputs may contain sensitive data (ARNs, tags).
Never grant: AdministratorAccess for interactive use
- Always verify active profile and region before destructive commands. Skill prints both before execution — don't skip the check.
- Use SSO short-lived credentials rather than long-lived access keys.
Troubleshooting
Common errors and fixes
AccessDenied despite correct profile
Role session may have expired. Re-authenticate (aws sso login or STS refresh)
Verify: aws sts get-caller-identity
Commands hit the wrong region
Skill respects AWS_REGION env; set explicitly or pass --region each call
Rate-limiting on large fleet ops
Use the skill's batch mode with delays
Alternatives
aws-skills vs others
| Alternative | When to use it instead | Tradeoff |
|---|
| AWS MCP server | You want native MCP tool calls instead of shell-first | Less shell visibility; different trust model |